DPT-S1 recovery

[etn40ff]

Dear all,
is it bossible to use rupor-rescue.7z from here to boot the sony digital paper in recovery mode?
Do you know if this recovery flashes something automatically or if it just sits down and wait for a connection via serial/usb? The disk image looks like it has some stuff to flash (especially under /usr/local/sony and /diag).
Also I noticed there is no kernel in this emage file, does it load with the kernel already onboard?
Thanks

[etn40ff]

So I took the plunge and gave it a spin myself. Here is the, somewhat long and boring, report on what happened. TL;DR: nothing.

This is the content of rupor-rescue.7z:

OS Firmware/
OS Firmware/files/
OS Firmware/files/update.img
gserial.inf

gserial.inf is needed to let Windows recognize the e-reader as a serial port when in rescue mode.
update.img is an ancient linux filesystem:

# file OS\ Firmware/files/update.img
OS Firmware/files/update.img: Linux rev 1.0 ext2 filesystem data, UUID=ddaa282f-f831-4e1e-a80e-04c2a71d3cbf

You can easily mount it with a loop device and poke around

# mount  -o loop OS\ Firmware/files/update.img /mnt

It turns out that it is based on a Freescale rescue image with some extra bits pulled in by Sony:

# cat /mnt/etc/issue
arm-none-linux-gnueabi-gcc (GCC) 4.1.2
root filesystem built on Thu, 09 Dec 2010 16:54:36 +0900
Freescale Semiconductor, Inc.

meant to run on a 2.6.35.3 kernel. The kernel is nowere to be found. I can't read Russian but from what I could gather from google translate this rescue image requires the device to be in an almost working state. In particular the boot partition should be there. I assume this is meant to boot using the kernel already on the device. This is nonsensical unless you put things in prospective: this was meant as an update tool and was hacked into a recovery system (I assume by rupor).

Which lead us to the bits added by Sony. There is a dir called /diag with several scripts and commands that look like the backhand of the TestApp. Then there is another dir /usr/local/sony with a script performing the update. This script is launched by /etc/rc.d/rc.drbd which was launched by etc/rc.d/rcS. Whoever created this rescue commented out the relevant part to prevent rc.drbd from loading.
To be extra safe I removed both dirs. The rest of the image looked fine so I put it in the device and rebooted into recovery-mode. It booted once, the led blinked some then rebooted into standard mode. I had a computer hooked up on the usb the whole time and looked at kernel messages. Nothing until the system is back up in normal mode. In particular no serial port.

Among the many things that could be going wrong my favourite is the following: the kernel onboard is not 2.6.35.3 (which is definitely old) and does not load the modules.
I think the usb to serial port is provided by g_multi.ko and arcotg_udc.ko. One could try to force load the modules...maybe some other day.

One other insight one can gather from the examination of the scripts in /usr/local/sony is that to extract any update file we need a dump of part of the mmc. I have no idea on how to get one at the moment.

Should any of you have other ideas please chime in.

[Alexey.deep]

Originally Posted by etn40ff

meant to run on a 2.6.35.3 kernel. The kernel is nowere to be found. .

http://oss.sony.net/Products/Linux/A..._20111114.html

I have no ideas but i will be happy to help you with testing and googling

[etn40ff]

Thanks for posting that. I ran into it at a certain point after opening this thread but, by then, I already realized that the hole allowing to boot a recovery was patched. As I said in another post we are in a situation very much like the one of PRS-T2 with the updated firmware.

One other avenue would be to compile uboot and put it on an sdcard: there is a remote possibility that they left the boot from sdcard open for internal testing. In the unlikely event that this is true we might also have to look for the pins that control boot devices on the board. Sounds harder than actually attaching the internal mmc to a sdcard reader

[lqm03101313]

someone in China has cracked the device, while it's not free. but i did not get a copy of the image

[etn40ff]

Originally Posted by lqm03101313

someone in China has cracked the device, while it's not free. but i did not get a copy of the image

Can you provide more info?

[gamba66]

Originally Posted by etn40ff

Can you provide more info?

did you get any further with this? this is basically the only resource I found where someone analyzed how to root the s1

I made a thread on xda developer: https://xdaforums.com/t/sony-dpt-s1-...#post-89341104

Please join in if you are interested in rooting your dpts1